Documentation and Tracking of Response Actions

Lesson 25/35 | Study Time: 20 Min

Course: ISO 27035 Information Security Incident Manager Course

Documentation and tracking of response actions are essential activities during the incident response process to ensure transparency, accountability, and effectiveness.

Detailed records provide a chronological trail of all activities undertaken, decisions made, and resources used to manage and mitigate security incidents.

Proper documentation supports continuous improvement, regulatory compliance, and legal requirements and serves as a valuable reference for future incidents and audits.

Importance of Documentation and Tracking

Maintaining comprehensive documentation allows incident response teams and stakeholders to:

1. Understand the sequence of events and actions taken

2. Evaluate the effectiveness of the response and identify gaps

3. Ensure compliance with organizational policies and legal mandates

4. Facilitate communication among internal teams and external partners

5. Support forensic investigations and potential legal proceedings

What to Document During Incident Response

Documentation Element	Description
Incident Details	Record the date and time of detection, incident description, affected systems, and overall scope of impact.
Response Actions	Document all containment, eradication, recovery, and mitigation steps taken, including timestamps for each action.
Decisions Made	Note key decisions, the individuals who made them, the rationale behind each choice, and any required approvals.
Communication Records	Maintain a record of all internal and external notifications sent, including details of stakeholders, vendors, and authorities informed.
Resource Usage	Track personnel involved, tools and technologies used, and any external assistance or service providers engaged.
Incident Impact	Capture the business implications such as system downtime, data loss, financial costs, regulatory implications, and reputational effects.
Post-Incident Activities	Summarize lessons learned, follow-up actions planned, and recommendations for improving future incident response processes.

Previous Lesson Next Lesson

Scott Hamilton

Product Designer

Profile

Class Sessions

1- Definition and Significance of Information Security Incidents 2- Types of Security Incidents and Threat Landscape Overview 3- Incident Management Objectives and Benefits 4- Overview of Relevant Standards: ISO/IEC 27035 and Alignment with ISO/IEC 27001 5- Roles and Responsibilities of an Information Security Incident Manager 6- Incident Management Lifecycle Phases 7- Developing and Implementing Incident Management Policies and Procedures 8- Establishing Governance and Organizational Support 9- Incident Classification and Prioritization Techniques 10- Stakeholder Identification and Communication Planning 11- Building an Incident Response Team and Defining Roles 12- Tools, Technologies, and Resources for Incident Management 13- Incident Readiness: Training, Awareness, and Simulation Exercises 14- Establishing Incident Detection and Reporting Mechanisms 15- Coordination with External Entities (Law Enforcement, Vendors, CERTs) 16- Methods and Technologies for Incident Detection and Monitoring (SIEM, IDS/IPS, Logs) 17- Incident Validation and Initial Assessment Techniques 18- Root Cause Analysis and Forensic Considerations 19- Documentation and Evidence Handling Procedures 20- Escalation Processes and Decision Making 21- Strategies for Incident Containment and Mitigation 22- Communication and Coordination During Incident Response 23- Managing Resources and Response Teams Effectively 24- Handling Multiple Concurrent Incidents 25- Documentation and Tracking of Response Actions 26- Eradication Techniques and Removal of Threats 27- System Restoration, Recovery Planning, and Business Continuity Considerations 28- Post-Incident Review and Lessons Learned Workshops 29- Reporting and Compliance Obligations 30- Continuous Improvement and Updating Incident Management Policies 31- Key Performance Indicators (KPIs) for Incident Management Programs 32- Incident Trend Analysis and Reporting Techniques 33- Internal and External Reporting Requirements 34- Conducting Audits and Maturity Assessments 35- Lessons Learned Integration and Feedback Loops to Improve Processes